Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,061 detections
Filters
Last updated
All Time
Detection languages
594
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,872
5,155
4,866
1,061
Platforms
576
267
228
221
116
Products / Services
499
220
129
118
86
MITRE Techniques
487
451
362
349
339
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Exploring M365 Accounts Investigation
KQL Query
KQL Query from file: BadSuccessor Detection
KQL Query from file: EntraFalcon Detection
KQL Query from file: Hunting Rockstar 2FA
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query from file: MailItemsAccessed Defense
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Detecting High Risk Passkey Users
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query
KQL Query from file: Azure cloud account takeover
KQL Query from file: Check for Entra Legacy TLS Login
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
Page 41 of 51